The CJEU decided on the processing of Facebook data. Expert: Meta illegally sucks data

In 2019, the German equivalent prohibited Meta Platform Irelands – the owner of Facebook, WhatsApp or Instagram – from using clauses that make the use of Facebook conditional on consent to the processing of their data. Facebook did not like the decision and sued it to , which has just issued a verdict in this case.

“EU Court of Justice has declared that Meta () collects data illegally. Forced ‘consent’ is not GDPR compliant.” (…) The CJEU first of all recognizes that the collection of data from third parties for the personalization of advertisements is not necessary for the provision of a social network service. Evidence. But that means ‘legitimate interest’, however, is unjustified. Meta works by illegally sucking data. The court also notes that consent is virtually impossible in the case of a dominant platform. Participation in the network is necessary for functioning, so we accept the abusive clause. But this is NOT a valid consent,” explains Jan Oleszczuk-Zygmuntowski, an economist specializing in the digital economy, on Twitter.

Facebook has a problem with data collection

The whole case concerned the collection of data from Facebook, in particular the so-called off-Facebook data. “It is, firstly, about data on third-party websites and applications viewed and, secondly, about the use of other Internet services belonging to the Meta group (such as Instagram or ). The data collected in this way allows, in particular, to personalize the targeted to Facebook users of advertising messages” –

The German office stated that this violates the rules related to the GDPR. Facebook, on the other hand, wanted the CJEU to check whether national antitrust authorities can invoke these provisions at all. The Tribunal found that, yes, as part of the examination of the abuse of a dominant position, antimonopoly offices may deal with the GDPR.

Moreover, it was indicated that the processing of data by Meta violates the provisions on the processing of special categories of data, i.e. those that may reveal information about racial or ethnic origin, political views, religious or philosophical beliefs, or sexual orientation. Their processing is generally prohibited. Ultimately, however, it is up to national courts to decide whether the data collected in this way actually allows the disclosure of the listed categories of information.

The CJEU also stated that the mere browsing of websites or applications by the user does not mean that these data have been made public within the meaning of the GDPR. Facebook believed that this could fall under the possibility of using sensitive data, given that it was obviously shared.

In non-sensitive cases, the Court considered that their processing without consent may be allowed, but only if it would be necessary for the operation of Facebook. It is for national courts to verify this, but the CJEU has doubts “as to whether the personalization of content or the continuous and uninterrupted use of the Meta group’s own services could meet these criteria. social network Facebook, cannot justify, as pursued by Meta Platforms Ireland, a legitimate interest, the data processing in question in a situation where the data subject does not consent to it.

According to the CJEU, although Facebook has a dominant position on the social networking market, this does not mean that users cannot effectively consent to data processing within the meaning of the GDPR. “However, since such a position may affect the users’ freedom of choice and result in an imbalance between the data subject and the controller, it is an important element in determining whether this consent has actually been given effectively and – in particular – voluntarily. It is up to that operator to prove it.”

The judgment of the CJEU confirms the diagnosis made by most experts and social activists. The scale of Meta surveillance is not justified by anything – neither forced consent nor “business model”. This is data extortion on a massive scale, the looting of a key resource for the 21st century

– comments on the judgment of Oleszczuk-Zygmuntowski.

“Will our government recognize the verdict and act on it?”

Jan Oleszczuk-Zygmuntowski emphasized that the CJEU judgment protects citizens, including Poles, against corporations. He also asked whether the Polish government would recognize the verdict and react, naming Janusz Cieszyński, the Minister of Digitization. However, he didn’t answer. In further entries, the economist wonders whether, in connection with this judgment, PiS will finally “start to play in the interest of Poland”?

Can we count on the CJEU and Brussels again, and from them [rządu – red.] we’ll hear “poor innocent banks” and “let’s not go to war with Big Tech”. So how?

– writes Oleszczuk-Zygmuntowski.